CVE-2026-114613 MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure

MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.3, the msgpack-python C extension msgpack.cmsgpack leaks a decoded map value when deserialization rejects a key with strictmapkey=True the default. Repeated malformed inputs can cause unbounded process memory growth...

DEBIAN-CVE-2026-114610

fpdf2 is a PDF creation library for Python. From 2.5.0 until 2.8.8, fpdf2's SVGObject.buildxref passes nested SVG references to GraphicsContext.additem, whose default clone=True deep-copy behavior copies the complete referenced graphics tree during FPDF.image processing. Repeating references at...

CVE-2026-114610

fpdf2 is a PDF creation library for Python. From 2.5.0 until 2.8.8, fpdf2's SVGObject.buildxref passes nested SVG references to GraphicsContext.additem, whose default clone=True deep-copy behavior copies the complete referenced graphics tree during FPDF.image processing. Repeating references at...

CVE-2026-114610

fpdf2 is a PDF creation library for Python. From 2.5.0 until 2.8.8, fpdf2's SVGObject.buildxref passes nested SVG references to GraphicsContext.additem, whose default clone=True deep-copy behavior copies the complete referenced graphics tree during FPDF.image processing. Repeating references at...

CVE-2026-114610

fpdf2 is a PDF creation library for Python. From 2.5.0 until 2.8.8, fpdf2's SVGObject.buildxref passes nested SVG references to GraphicsContext.additem, whose default clone=True deep-copy behavior copies the complete referenced graphics tree during FPDF.image processing. Repeating references at...

CVE-2026-114609

The fpdf2 PDF creation library for Python (prior to version 2.8.8 ) contains a vulnerability where the shared image loader automatically dereferences attacker-controlled HTTP(S) URLs and raw local paths. This occurs when processing inputs from FPDF.image() , FPDF.write_html() (HTML values), SVG ...

CVE-2026-114609

fpdf2 is a PDF creation library for Python. Prior to 2.8.8, fpdf2's shared image loader automatically dereferences attacker-controlled HTTPS URLs and raw local paths supplied through FPDF.image, FPDF.writehtml HTML values, SVG or xlink:href values, and template image fields. This can cause outbou...

CVE-2026-114609 fpdf2 implicitly loads external URLs and local image paths when rendering attacker-controlled content

fpdf2 is a PDF creation library for Python. Prior to 2.8.8, fpdf2's shared image loader automatically dereferences attacker-controlled HTTPS URLs and raw local paths supplied through FPDF.image, FPDF.writehtml HTML values, SVG or xlink:href values, and template image fields. This can cause outbou...

CVE-2026-114609

fpdf2 is a PDF creation library for Python. Prior to 2.8.8, fpdf2's shared image loader automatically dereferences attacker-controlled HTTPS URLs and raw local paths supplied through FPDF.image, FPDF.writehtml HTML values, SVG or xlink:href values, and template image fields. This can cause outbou...

CVE-2026-114609 fpdf2 implicitly loads external URLs and local image paths when rendering attacker-controlled content

fpdf2 is a PDF creation library for Python. Prior to 2.8.8, fpdf2's shared image loader automatically dereferences attacker-controlled HTTPS URLs and raw local paths supplied through FPDF.image, FPDF.writehtml HTML values, SVG or xlink:href values, and template image fields. This can cause outbou...

DEBIAN-CVE-2026-75507

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.0.0 until 3.2.12 and 3.3.0rc1, the OverlappingFieldsCanBeMerged rule in specifiedrules repeatedly compares fields that share response names and recursively re-compares flattened inline fragments during the validation...

AZL-111002 CVE-2026-114605 affecting package python-dns 2.1.0-1

dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.fromwireparser follows attacker-controlled DNS compression pointer chains without a hop limit. A malicious DNS wire-format message can force excessive pointer traversal during name decompression, causing high CPU use, application...

python-webex-bot (0.51.0) potentially affected by CVE-2026-113721 via virtualenv (16.4.3)

virtualenv PYPI version 16.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - python-webex-bot 0.51.0 Source cves: CVE-2026-113721 Source advisory: OSV:GHSA-558C-9HV2-4PRJ...

cateye (>=0.3.4, <=0.3.8), edx-completion (>=0.0.1, <=0.1.1) +4 more potentially affected by CVE-2026-113721 via virtualenv (15.1.0)

virtualenv PYPI version 15.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - cateye =0.3.4, =0.0.1, =0.5.7, =1.0.0rc1, =1.2.0, =1.7.1 Source cves: CVE-2026-113721 Source advisory: OSV:GHSA-558C-9HV2-4PRJ...

backlogapi (>=0.1.3, <=0.1.5), dcoscli (>=0.4.10, <=0.6.1) +1 more potentially affected by CVE-2026-113721 via virtualenv (15.2.0)

virtualenv PYPI version 15.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - backlogapi =0.1.3, =0.4.10, =0.6.7, =0.7.1 Source cves: CVE-2026-113721 Source advisory: OSV:GHSA-558C-9HV2-4PRJ...

fzpycreate (>=0.0.12, <=2.0.0), neo-python (0.8.4) potentially affected by CVE-2026-113721 via virtualenv (16.2.0)

virtualenv PYPI version 16.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - fzpycreate =0.0.12, =2.0.0 - neo-python 0.8.4 Source cves: CVE-2026-113721 Source advisory: OSV:GHSA-558C-9HV2-4PRJ...

hlvox (0.3.10), python-whiteprint (0.7.0) +2 more potentially affected by CVE-2026-113721 via virtualenv (20.16.5)

virtualenv PYPI version 20.16.5 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - hlvox 0.3.10 - python-whiteprint 0.7.0 - traffic-guardian =1.0.1, =0.1.9, =0.3.7 Source cves: CVE-2026-113721 Source advisory:...

dai-python-commons (>=5.4.17, <=5.4.18), foundation-cancer-image-biomarker (>=1.0.1a4, <=1.0.1a5) +6 more potentially affected by CVE-2026-113721 via virtualenv (20.27.1)

virtualenv PYPI version 20.27.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - dai-python-commons =5.4.17, =1.0.1a4, =0.1.0, =0.1.1, =0.1.0, =0.1.3 - python-rektor-monitor 0.1.1 - pyxote 0.1.0 Source cves:...

dcoscli (>=0.1.9, <=0.4.6), python-mu (>=1.0.1, <=1.0.3) +1 more potentially affected by CVE-2026-113721 via virtualenv (13.1.2)

virtualenv PYPI version 13.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - dcoscli =0.1.9, =1.0.1, =0.2.23, =0.2.34 Source cves: CVE-2026-113721 Source advisory: OSV:GHSA-558C-9HV2-4PRJ...

cabrita (>=2.2.2b1, <=2.2.2b2), kaze-python (>=0.7.8, <=0.8.9) +2 more potentially affected by CVE-2026-113721 via virtualenv (16.0.0)

virtualenv PYPI version 16.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - cabrita =2.2.2b1, =0.7.8, =0.7.2, =1.7.2, =1.11.0 Source cves: CVE-2026-113721 Source advisory: OSV:GHSA-558C-9HV2-4PRJ...